Dear TF members, Here are the minutes from our last call. Cheers Kjerstin *** 7 April 16:30 (UTC+2) Attendees: Denesh Bhabuta, Antony Gollan, Brian Nisbet, Leo Vegoda Scribe: Kjerstin Burdiek Summary: The TF discussed the CoC Team’s record retention. The process document made a distinction between personal data retention, which would be limited to 18 months for minor breaches and 36 months for serious breaches, and retention of anonymised data for detecting behaviour patterns. The TF also discussed the appeals process and decided personal data for reporters should only be retained until the conclusion of an appeal. Following this, Leo shared the blog post he had drafted for the community. The TF reviewed it and decided to include a request for community feedback about the data retention periods. Finally, Leo shared the BoF proposal he had drafted for RIPE 84. The TF considered whether to add time for discussion of the process document at the BoF. The group decided to focus on using the session to help with CoC Team recruitment but resolved to review whether some discussion would be needed based on community feedback on the published document. Leo planned to submit the BoF proposal later in the day, while the RIPE NCC would review the blog post and the process document, to be published early in the next week. 1. Minutes The minutes from the previous two meetings were approved with no changes. 2. Agenda There were no changes to the agenda. 3. Actions - (Ongoing) TF to think about how the CoC Team and the WG Chairs would work together to manage discussions on mailing lists. Including tools, e.g. Mattermost channel This item remained ongoing. - (Ongoing) TF to think about the appropriate level of process to allow further improvements to the CoC. This item remained ongoing. -Athina to review the draft in regard to record-keeping. This was done. -Leo to draft a proposal for a BoF at RIPE 84. This was done. 4. Record Retention Antony pointed out that there was a difference between retaining personal data during a CoC investigation, which would only be maintained as long as necessary to enforce the consequence, versus retaining an anonymised record of misconduct. These anonymised records would help the CoC Team make decisions about consequences in future cases and would allow for identifying trends. To satisfy GDPR requirements, the process document included an explanation for why this data was being held and for how long. Data would be held for both the reporter and the subject of the report for the same length of time. For minor breaches, such data would be kept for 18 months, for major breaches, 36 months. For longer consequences, such as bans, data would be held for as long as was necessary to carry out this consequence. Leo asked if the TF should explain the rationale for these time periods in their blog post. Antony said they could explain these periods were based around RIPE Meetings. Leo said it was important to mention this rationale. Antony noted that no personal data for reporters or witnesses would be kept for longer than 36 months. He suggested that the CoC Team retain data long enough that it could inform a reporter about any appeal overturning the decision of their original investigation. Brian said the Team should not be required to inform the reporter of this, only as appropriate. Leo said the 18-month appeal period could be distressing for reporters and that no appeal should last that long. The TF should just say the Team would retain personal data until the conclusion of an appeal, without stating a specific time period. Antony updated this in the document. He asked for feedback on the section about retention of personal data. Brian said it would be fine to retain personal data that was fully anonymised. Leo asked if the TF was ready to share the document with the community. Antony said he would review the wording again first. Brian said the wording just needed to be consistent. Leo asked the RIPE NCC to work with its Legal team to ensure the document was consistent. Then the document would be ready to publish. Antony said the RIPE NCC would check the document again. Leo said it would be best to publish on the following Monday or Tuesday. 5. Blog Post The TF discussed the wording in the summary. Leo asked the RIPE NCC to make changes in this section as needed. Antony asked if the questions for the community captured what the TF wanted to ask. Leo suggested asking for community feedback about the time periods for data retention and the retention of anonymised data to detect behaviour patterns. Antony asked what the TF should do if the community opposed this data retention. Leo said that would indicate there was no consensus, which was why it was important to ask. But the TF should be very clear in explaining the purpose of this data retention to the community. Brian noted that retaining data for some time made sense as many people in the community would not attend every RIPE Meeting. He suggested directly asking the community if the time periods were sufficient. Leo said the legalistic part of the text would likely generate the most feedback, which would help the TF know which parts needed to be clarified for the community. Going forward, he would improve the wording of the questions in the blog post and then send an updated version to the list for the RIPE NCC to review. Antony offered to publish the process document after reviewing it. Leo said this would be good. 6. BoF Leo shared the content of the BoF proposal, which included the CoC Team recruitment and training process, with presentations from Antony and Athina. Brian had noted the TF should more clearly state that people interested in joining the CoC Team should attend this BoF. Leo asked if the TF members wanted to mention anything else in the proposal. Brian asked whether the TF should discuss the process document at the BoF. Denesh said discussion needed to be brief to fit into the session. Antony said the community would want time to discuss the document if they had criticism to share. Denesh said the TF should just be clear about the BoF’s content in the agenda and follow it closely. Leo said that since people not at the BoF would miss out on the discussion, the TF should focus on this as a CoC Team recruitment session. The discussion about the CoC process document should involve the whole community. Antony said the TF could have two possible plans for the BoF and choose one based on the mood of attendees. If people wanted to share feedback, then the TF should let them. Brian said the TF should be prepared to discuss the document if needed, but they should still make sure to discuss the main topics they had wanted to bring up. Leo said this made sense. Also, after the three-week review period, the TF would know the community’s overall response to the document. A week or so before the RIPE Meeting, the TF could decide whether they would keep their planned agenda or add more time for discussion. He asked Brian if this should be in the BoF proposal. Brian said the content of the proposal did not need to be exact. Leo said he would submit the BoF proposal later in the day, with more focus on recruitment. 7. AOB There was no other business. 8. Actions -RIPE NCC to review the process document and the blog post. -Leo to submit BoF proposal for RIPE 84.